1. Edit the entries that TeaTimer uses to automatically "Allow" or "Deny" changes that were based on the use of "Remember this decision" as follows:

* Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List": o Allowed processes o Blocked processes o Allowed registry changes o Blocked registry changes

Note: If you don't see all four buttons, try expanding the window to the right.

* The entries that you should review are in "Allowed registry changes" and "Blocked registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

2. Reset TeaTimers snapshot files:

* TeaTimer takes snapshots of Registry entries and compares these with the Registry at startup. Until these snapshots are updated you are likely to get pop-ups (at startup) of changes you made in the past. In other words, TeaTimer attempts to return the Registry to the state it was in when the snapshot was taken. This happens primarily when you reboot the system. To refresh TeaTimer's snapshot files: o Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident. + TeaTimer closes. + TeaTimer's snapshot files are refreshed at this time. o Restart TeaTimer: + Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy. + Double click TeaTimer.exe to start it.

Before you restart Teatimer, run a full scan with Spybot and remove the infections. Then restart TeaTimer, After that, reboot windows and then run a full scan again. See if the prunnet entry comes back.

Logged

Former Consumer Security MVP 2011-2014

If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

Do a search on your entire harddrive for Prunnet with no extension. Delete anything that is named prunnet that is found. Then turn off your computer, not just reboot it. Then start it back up again and run a full scan with Malwarebytes' Anti-Malware after updating it, and then with Spybot. Post the log up from Malwarebytes' Anti-Malware and let me know how Spybot ran. Then reboot and see if the registry entry comes back.

Logged

Former Consumer Security MVP 2011-2014

If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

It looked promising. I shut down completely and rebooted in Safe Mode. Did an MBAM and Spybot scan which cleaned prun.exe.

I rebooted in Normal Mode and Spybot started automatically. It said I was clean.

Shut down and rebooted again and it showed up again.

Will repeat again tomorrow.

ErrorNukerInstaller.exe? Yeah, that was a mistake. Knew nothing of the company but was desperate for a solution. Fortunately, I uninstalled it just as soon as I had installed it. The downloaded exe files were sitting around in a few places though

Download and scan withCCleaner1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option ORdownload the toolbar-free or Slim versions instead of the Standard Build.2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"3. Then select the items you wish to clean up.In the Windows Tab:

Clean all entries in the "Internet Explorer" section except Cookies if you want to keep those.

Clean all the entries in the "Windows Explorer" section.

Clean all entries in the "System" section.

Clean all entries in the "Advanced" section.

Clean any others that you choose.[/COLOR]

In the Applications Tab:

Clean all except cookies in the Firefox/Mozilla section if you use it.

Clean all in the Opera section if you use it.

Clean Sun Java in the Internet Section.

Clean any others that you choose.[/COLOR]

4. Click the "Run Cleaner" button.5. A pop up box will appear advising this process will permanently delete files from your system.6. Click "OK" and it will scan and clean your system.7. Click "exit" when done.

OK, from that file it is apparent that the file no longer exists, its just the registry entry. From your hijackthis log you are using Symantec. I need you to disable it from starting. Then run the instructions below. Reboot and see if the registry entry comes back. If it doesn't, set Symantec to start, and reboot and see if the registry entry is back. Let me know what happens.

Now, I want you to fix some autostart items by using the RUN file that I have attached with items marked for deletion: